Which two of the following phrases would apply to "audit objectives"?

Audit objectives define what is to be accomplished by the audit. According to ISO 19011, a primary objective is to determine the extent of conformity of the management system with the audit criteria (e.g., the ISO/IEC 27001 standard, policies, and legal requirements). Another key objective, particularly valued in both internal and external audits, is to identify opportunities for improvement within the management system. These objectives set the scope and purpose of the audit engagement, guiding the audit team's activities.

A. Audit duration is a logistical element of the audit plan, not an objective defining the audit's purpose.
C. Checking legal compliance is a component of determining conformity, making it a subset of option B, not a distinct objective type.
D. Auditor competence is a prerequisite for conducting an effective audit, not a goal of the audit itself.
E. Revising management policy is a potential outcome or corrective action resulting from audit findings, performed by the organization's management.

1. ISO 19011:2018

Guidelines for auditing management systems

Clause 5.3

"Establishing the audit programme objectives". This clause states that objectives can include "determining the extent of conformity" and "identifying opportunities for the potential improvement of the management system".

2. von Solms

R.

& von Solms

S. H. (2005). From information security to business security?. Computers & Security

24(4)

271-273. https://doi.org/10.1016/j.cose.2005.04.004. The paper discusses how audits verify conformity and drive improvement

aligning with these objectives.